CenterPoint Energy Data Breach: What Houston Businesses Should Do Now

Ten fields on a state website, read against the company's own SEC filing.

The Texas Attorney General's Data Security Breach Reports listing is the public record of every breach reported to the state that involves 250 or more Texans. As of October 18, 2026, it held 662 entries. The CenterPoint Energy, Inc. entry, published October 13, 2026, lists 1,062,060 Texans affected; the types of information as name of individual, address, Social Security Number information and driver's license number; notice provided to consumers as No; and the method of notice as a dash.

Put that beside the September 14 filing. CenterPoint Energy, Inc., CenterPoint Energy Houston Electric, LLC and CenterPoint Energy Resources Corp. filed a joint Form 8-K under Item 8.01. The filing says the company became aware of an online post by a third party claiming to have obtained a data set containing some customer information, activated its cybersecurity incident response protocols, engaged third-party cybersecurity experts, and determined that an unauthorized third party obtained personal information relating to a portion of its customers through one of the company's external-facing systems. It says CenterPoint reported the matter to law enforcement, notified certain regulatory authorities, maintains customary cybersecurity insurance that it believes will offset related costs, and does not believe the incident is reasonably likely to have a material impact on its financial condition or results of operations.

Each of those statements describes CenterPoint. The listing is the first document that describes the customer. It supplies the count, the data types and the notice status, and it does so under a Houston street address, 1111 Louisiana St., ZIP code 77002, that any customer, competitor or reporter can pull up with the search box.

The listing carries its own caveat, printed above the table: details including the number of affected Texans and whether notice was provided may change after a report is listed. Read the 1,062,060 as the figure CenterPoint reported to the state on the date the entry went up, and expect it to move as the company's third-party experts finish scoping the data.

Texas Business and Commerce Code 521.053 runs two deadlines from one starting date, and only one of them is public.

Texas breach notification law gives a business 60 days to notify affected individuals and 30 days to report to the Attorney General when 250 or more Texas residents are involved, both counted from the day the business determines the breach occurred. The Attorney General must then post the report on a public listing and update that listing within 30 days of receiving it. The state report is due first and becomes public on arrival, so the record can precede the letters by a month.

Apply that to CenterPoint. The Form 8-K is dated September 14, 2026 and the listing entry was published October 13, which is 29 days later. If CenterPoint determined the breach on or around the day of its filing, the 30-day Attorney General window closed October 14 and the 60-day individual window runs to November 13, 2026. The company has not published its determination date, so those dates are bounds rather than facts, and the statute also allows a delay at the request of law enforcement or for the time needed to determine the scope of the breach and restore the system.

The sequence is legal and ordinary. Texas requires the report to go to the state first and makes it public on arrival, while the same statute gives a business twice as long to reach each affected person by mail or by electronic notice. The design produces exactly what Houston saw in October: a count on a state website while mailboxes stayed empty.

Under this law, a No in the notice column on the day of listing means the letters are still inside their 60-day window. Act as if yours is coming, and do not wait for it before freezing credit or briefing staff.

What a 1,062,060 figure means in a metro where nearly every workforce shares one electric and gas utility.

The CenterPoint Energy data breach is a Houston workforce problem because CenterPoint counts 2.9 million customers in Greater Houston, by its own September 24, 2026 statement, and the listing's 1,062,060 affected Texans equals more than a third of that number. The listing counts people across CenterPoint's Texas territory rather than Houston accounts, so the two figures are not the same unit. For a Katy or Sugar Land employer, though, the working assumption is that a large share of staff hold an account that was in scope.

Scale matters here. The CinchOps Texas Breach Notice Index, which counted the 652 reports on the same listing as of October 3, 2026, found that the median report covers 1,668 Texans and that 82.5% of reports involve Social Security numbers. The CenterPoint entry is more than 630 times that median. Houston-area filers, meaning ZIP codes 770 through 775, accounted for 81 of the 652 reports.

The second Houston-specific point is the data combination. Name plus address plus a known utility relationship is the raw material for impersonation. The FTC's IdentityTheft.gov guidance warns that scammers might pretend to be from a business you know, like a utility company. In Houston that business is CenterPoint for most households, and a text about a disconnection, a refund or a "breach verification" now arrives with the right name and the right street. Pair that with a Social Security number and a driver's license number and the same record supports new credit accounts, a fraudulent tax return or employment under someone else's identity.

Business accounts sit inside the same exposure. If an owner's or a guarantor's personal details sit on a commercial electric account for a Cypress shop or a Woodlands office, that person carries the identity-number risk, and the accounts payable desk that pays the CenterPoint bill is the natural target for a payment-change email. Whether commercial records were among those taken is not public.

The listing does not say which customers, which years or which systems, and CenterPoint has not said either. For a Houston employer the sensible planning number is the one on the state record, and the sensible assumption is that your own staff are in it.

The FTC's post-breach steps, applied to a Houston company and the people on its payroll.

A Houston business should do two sets of things this week: help every employee lock down the identity data the listing names, and harden the company against the scams that data enables. The FTC's IdentityTheft.gov sets out the first set as Step 1, check, freeze and monitor your credit, followed by steps for each type of information exposed. The second set is internal procedure, and it costs an hour.

For people, the credit freeze comes first. The FTC states that there is no cost to place or lift a credit freeze, that it lasts until you lift it, and that you place one by contacting all three credit bureaus, Equifax, Experian and TransUnion. A fraud alert is the lighter option: an initial alert lasts one year and can be renewed, an extended alert lasts seven years for people who hold an identity theft report, and unlike a freeze it does not stop businesses from seeing the credit report. For an exposed Social Security number, the FTC adds reviewing your Social Security work history at socialsecurity.gov/myaccount, locking the number at e-verify.gov/mye-verify, and filing taxes early before a scammer can. For an exposed driver's license number, it says to contact the nearest driver license office, which may flag the number or suggest applying for a duplicate.

For the company, the procedures are short. Brief staff that CenterPoint-themed texts, calls and emails are now personalized, and that the FTC's rule applies: do not use the number or link in the message, look the contact up independently. Add a callback rule in accounts payable for any change to how a utility or vendor gets paid, verified against a number already on file. Then check what personal information your own business holds on behalf of others, because the listing you have been reading is the same one your company's name would appear on.

None of this depends on a letter from CenterPoint. The freeze is free, the SSA and E-Verify accounts are free, and the callback rule is a sentence in a procedure. Do them this week; under the 60-day rule the notices may still be weeks away.

The same statute, the same listing and the same public fields apply to a 40-person firm.

A Katy business with 250 or more affected Texans would appear on the Texas Attorney General's breach listing under the same rules as CenterPoint: a report within 30 days, a public entry with its name, address, city and ZIP code, the data types, the count and a notice column, and letters to every affected person within 60 days. The statute defines sensitive personal information as an unencrypted name combined with a Social Security number, a driver's license or government ID number, an account or card number with its access code, or identifying health information. Payroll and HR files at most Houston employers meet that definition.

The thresholds are low. A CPA practice in Sugar Land holding 300 client tax files, or a construction contractor in Katy with 260 employee I-9 records, crosses the 250-Texan line in a single incident. Past 10,000 people, the law adds notice to the nationwide consumer reporting agencies. Penalties under section 521.151 run $2,000 to $50,000 per violation, plus up to $100 per individual per consecutive day of failing to take reasonable action on individual notice, capped at $250,000 for a single breach.

Two details of CenterPoint's filing read differently at small-business scale. The 8-K says the company became aware of the incident through a third party's online post, which means the attacker announced the breach before the company's own monitoring did. The 8-K also says CenterPoint does not expect a material financial impact, with customary cybersecurity insurance offsetting the costs. A business with 10 to 200 employees has neither buffer. A public entry carrying its ZIP code and a No in the notice column is material by itself, and the Texas safe-harbor defense under SB 2610, available to businesses with fewer than 250 employees, depends on showing that a conforming cybersecurity program was in place at the time of the breach.

The lesson is the order of discovery. When a third party can tell you about your own breach before your logs do, the 30-day and 60-day clocks start on the attacker's schedule, with the public record already in motion.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

The CenterPoint listing is a preview of what any Houston employer faces after a breach: a count to produce in 30 days, letters to send in 60, and a public record in between. CinchOps builds the capability to meet those clocks before an incident, and to detect the incident before a third party does.

• Through managed IT support, CinchOps keeps an inventory of where sensitive personal information lives across a client's servers, laptops and cloud accounts, so the 250-Texan question can be answered in hours rather than weeks.
• Through cybersecurity services, 24/7 threat monitoring watches the kind of external-facing systems named in CenterPoint's filing, and help desk requests are answered in under 15 minutes when an employee reports a CenterPoint-themed text.
• When an incident does happen, CinchOps' breach response work scopes the affected records and preserves evidence against the 30-day and 60-day Texas deadlines.
• On the business continuity and disaster recovery side, verified, immutable offsite backups keep the records needed to count and notify affected people intact after an incident.
• For CPA firms, law firms and construction companies across Houston, Katy and Sugar Land, the files that meet the Texas definition of sensitive personal information are the files CinchOps protects first.

A Houston business cannot choose which utility loses its customer file, but it can decide whether its own name ever appears on the same listing, and whether it learns about a breach from its monitoring or from a stranger's post. Build the inventory, the monitoring and the response plan now, while the only entry you are reading is someone else's. Talk to CinchOps.